Rate-limited OTP sign-in
Four-digit one-time codes expire quickly and have phone, network, resend, and daily sending limits. A keyed daily counter allows no more than five failed verifications for one phone across replacement codes.
Security centre
Trust comes from controls you can explain.
360 Prime Express keeps important delivery actions behind verified access and server-side decisions. This page describes the controls without making impossible guarantees.
Core controls
Protection across the delivery journey.
The website or mobile device presents information and requests actions; the backend decides whether protected changes are allowed.
Authoritative pricing
The server resolves trusted location records, checks the service boundary, validates every stop, and owns the quote fields before a delivery enquiry is stored.
Server-controlled payment state
Paystack’s signed server notification marks online orders paid. Cash selection requires the signed order session and remains unpaid until the rider records collection.
Validated delivery state
Assignment and rider milestones follow legal server-side transitions, with ordered stops and server timestamps.
Restricted order chat
Conversation access is limited to the customer, assigned rider, and support that has joined the specific order.
Protected website requests
Customer requests and separate business leads pass through exact-origin checks, strict schemas, anti-automation controls, rate limits, and server-only database writes.
Public website safeguards
A small browser footprint with no tracking SDK.
The delivery website uses static HTML, local CSS, and minimal same-origin JavaScript. It does not load advertising tags, analytics trackers, third-party fonts, a client-side Firebase SDK, or a browser-readable authentication token.
- Restrictive Content Security Policy
- Clickjacking and MIME-sniffing protection
- Camera, microphone, location, and payment browser permissions disabled
- Route drafts stay in page memory, not browser storage
- Signed request and order sessions are inaccessible to page scripts
- Order status cannot be retrieved from a public reference alone
- Account deletion requires a fresh phone code and exact final confirmation
Route previewNo anonymous enquiry stored
Account creationAfter correct code only
Request sessionSigned, HttpOnly, 15 minutes
Order trackingOrder-scoped, up to 30 days
Account deletion sessionSigned, HttpOnly, 10 minutes
Business lead retentionMaximum 180 days
Design principleCollect less, protect more
Security guidance
Phone verification appears only when it is needed
The customer delivery flow asks for a Ghana phone number only after the route and item details are ready. The number is not enough to create an account: the correct four-digit one-time code must be verified first. A new verified number creates a customer account, while a recognised number reconnects to its existing account.
What we will never ask for in the business form
The separate business delivery form never asks for your one-time sign-in code, account password, mobile-money PIN, bank-card details, or Paystack credentials. The customer verification step asks only for the four-digit code just sent to the number you provided. Never place a code or financial credential in a notes field or share it with a caller.
Why the server uses HMAC
A keyed hash-based message authentication code, or HMAC, combines data with a secret held only by the server. 360 Prime Express uses separate secret-backed HMAC controls to protect one-time-code comparisons, key the cumulative per-phone failure limit, sign short website sessions, and create pseudonymous abuse identifiers. The secrets and raw security tokens are not shipped in website JavaScript.
Secure account deletion
The public account deletion page requires a fresh code sent to the account phone, issues a purpose-bound ten-minute session, rechecks active orders, and requires the account owner to type DELETE before the server removes personal information. The browser never receives a reusable authentication token.
Report an account or delivery concern
For an account-specific or active-delivery concern, use the Support request inside the relevant app conversation. This keeps the report connected to the authenticated user and delivery record. Do not publish personal route or payment information on public channels.
Security is ongoing work
No connected service can promise zero risk. Controls are reviewed, dependencies are audited, and security findings are prioritised according to their impact on customer and operational data.
For responsible reporting: provide a concise description, affected feature, steps to reproduce, and impact through the official in-app support path. Do not access, alter, or retain another person’s data.